You are building an application that processes data files uploaded from thousands of suppliers.
Your primary goals for the application are data security and the expiration of aged data. You need to design the application to:
- Restrict access so that suppliers can access only their own data.
- Give suppliers write access to data only for 30 minutes.
- Delete data that is over 45 days old.
You have a very short development cycle, and you need to make sure that the application requires minimal maintenance. Which two strategies should you use? (Choose two.)

• A.Set up an SFTP server for your application, and create a separate user for each supplier.
• B.Use signed URLs to allow suppliers limited time access to store their objects.
• C.Develop a script that loops through all Cloud Storage buckets and deletes any buckets that are older than 45 days.
• D.Build a Cloud function that triggers a timer of 45 days to delete objects that have expired.
• E.Build a lifecycle policy to delete Cloud Storage objects after 45 days.

Comment: *

Name: *

Email: *

Verification: *

You need to monitor resources that are distributed over different projects in Google Cloud Platform. You want to consolidate reporting under the same Stackdriver Monitoring dashboard. What should you do?

• A.Use Shared VPC to connect all projects, and link Stackdriver to one of the projects.
• B.For each project, create a Stackdriver account. In each project, create a service account for that project and grant it the role of Stackdriver Account Editor in all other projects.
• C.Configure a single Stackdriver account, and link all projects to the same account.
• D.Configure a single Stackdriver account for one of the projects. In Stackdriver, create a Group and add the other project names as criteria for that Group.

Comment: *

Name: *

Email: *

Verification: *

You recently discovered that your developers are using many service account keys during their development process. While you work on a long term improvement, you need to quickly implement a process to enforce short-lived service account credentials in your company. You have the following requirements:
* All service accounts that require a key should be created in a centralized project called pj-sa.
* Service account keys should only be valid for one day.
You need a Google-recommended solution that minimizes cost. What should you do?

• A.Implement a Cloud Run job to rotate all service account keys periodically in pj-sa. Enforce an org policy to deny service account key creation with an exception to pj-sa.
• B.Implement a Kubernetes Cronjob to rotate all service account keys periodically. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.
• C.Enforce an org policy constraint allowing the lifetime of service account keys to be 24 hours. Enforce an org policy constraint denying service account key creation with an exception on pj-sa.
• D.Enforce a DENY org policy constraint over the lifetime of service account keys for 24 hours. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.

Comment: *

Name: *

Email: *

Verification: *

You have deployed an application on a Compute Engine instance. An external consultant needs to access the Linux-based instance. The consultant is connected to your corporate network through a VPN connection, but the consultant has no Google account. What should you do?

• A.Instruct the external consultant to generate an SSH key pair, and request the private key from the consultant. Add the private key to the instance yourself, and have the consultant access the instance through SSH with their public key.
• B.Instruct the external consultant to use the gcloud compute ssh command line tool by using Identity-Aware Proxy to access the instance.
• C.Instruct the external consultant to use the gcloud compute ssh command line tool by using the public IP address of the instance to access it.
• D.Instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key.

Comment: *

Name: *

Email: *

Verification: *

Your organization has a dedicated person who creates and manages all service accounts for Google Cloud projects. You need to assign this person the minimum role for projects. What should you do?

• A.Add the user to roles/iam.roleAdmin role.
• B.Add the user to roles/iam.securityAdmin role.
• C.Add the user to roles/iam.serviceAccountUser role.
• D.Add the user to roles/iam.serviceAccountAdmin role.

Comment: *

Name: *

Email: *

Verification: *